- Check request tokens also in devel_mode

12 years ago · 2bbc3da52a
parent de56ea1909
commit 2bbc3da52a
1 changed files with 1 additions and 1 deletions
--- a/index.php
+++ b/index.php
@ -223,7 +223,7 @@ else {

  // check client X-header to verify request origin
  if ($OUTPUT->ajax_call) {
-    if (rcube_utils::request_header('X-Roundcube-Request') != $RCMAIL->get_request_token() && !$RCMAIL->config->get('devel_mode')) {
+    if (rcube_utils::request_header('X-Roundcube-Request') != $RCMAIL->get_request_token()) {
      header('HTTP/1.1 403 Forbidden');
      die("Invalid Request");
    }